Image

checkout:latest

ghcr.io/northcutted/clearcutt-showcase/apps/checkout

Checkout service (Go, stack go:1)

Meets every requirement in the policy.

Identity

Digest: sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313
Tags: latest
Created: 2026-10-17 00:00 UTC
Built by: clearcutt-factory (clearcutt-factory recipe)
Source: https://github.com/northcutted/clearcutt-showcase-checkout at 784b3b9991326a0e67d4089d0eb4daa9d5c6bf4e Read from build provenance that verified.
clearcutt-factory: App checkout; built with v0.3.0; pins 0 packages, 0 tools, 5 images; files clamped to 2026-10-17
Stack: go from the registry stack ghcr.io/northcutted/clearcutt-showcase/stacks/go:1, pinned at sha256:59ec0ee535b1.
Version: Pinned to the version the stack's tag names now. · Signature: Found, and checked against a trusted signer in the policy. · Every version of this stack

Base

Built on: ghcr.io/northcutted/clearcutt-showcase/platform/run-go:1 (run-go:1)
sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb
How it's known: The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency: On the newest version of its base observed in this run.
Newest observed: ghcr.io/northcutted/clearcutt-showcase/platform/run-go:1 sha256:f6a0ee0f0f63
Measured against the newest version observed in this run, not against upstream.

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-checkout	cosign signature	2026-10-18 14:26 UTC	ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:4e63dbc92be56a43d142369084d95da48c77abfb6a5c35b422721a2f55fa54cd
SBOM	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-checkout	cosign attestation	2026-10-18 14:26 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:6f776aaccb1b26575f17f6f74b9a1448e552a4f0c58214c48bf8df25b2ee5407
Vulnerability report	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-checkout	cosign attestation	2026-10-18 14:26 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:daab2dd7a2da9db96439fd8b44abea32c468a10b4d85cd5e53acae76c5753ae3
SLSA provenance	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-checkout	GitHub attestation	2026-10-18 14:27 UTC	ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:4c513d7e9717c641cc2ac311a3195b363302aa603fee115296ca20cdcdd44442
Recipe	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-checkout	cosign attestation	2026-10-18 14:26 UTC	ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:1f06483b8e48a9494a733ef1184cfac76cde084c610655fd75196d4a8d042e19
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.	—	declared in the recipe	—	The verified recipe declares a smoke test (GET :8080/healthz) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.

cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-checkout \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313

SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-checkout \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:6971d089b05e27045058e334f1ed5d1bc844039c510f01238633123b942f303f

SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-checkout \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:4d56ddccde41ab6872c2051a2678ca221a5bd2f25ab64c7868a2b8ffcf39312b

Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-checkout \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:6971d089b05e27045058e334f1ed5d1bc844039c510f01238633123b942f303f

Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-checkout \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:4d56ddccde41ab6872c2051a2678ca221a5bd2f25ab64c7868a2b8ffcf39312b

SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.

cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-checkout \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313

Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-checkout \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313

SLSA provenance (GitHub). Checks GitHub's artifact attestation with GitHub's own verifier, reading it from the registry: made by a workflow run in that repository, signed by that workflow.

gh attestation verify \
  oci://ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313 \
  --bundle-from-oci \
  --repo=northcutted/clearcutt-showcase-checkout \
  --signer-workflow=github.com/northcutted/clearcutt-factory/.github/workflows/images.yml \
  --source-ref=refs/heads/main

Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman. clearcutt-factory takes no source-ref flag; the cosign commands above check the ref.

clearcutt-factory verify \
  --image=ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-checkout

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313 > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","vulnerabilityScan","provenance","recipe"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-platform","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-checkout","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-catalog","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-storefront","sourceRef":"refs/heads/main","sourceMatchesImage":true}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":7,"stackSigners":[{"identity":"https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main","issuer":"https://token.actions.githubusercontent.com"}]}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, gh attestation, clearcutt-factory, clearcutt-verify, as of clearcutt-verify v0.16.0, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-18 14:26 UTC. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

	critical	high	medium	low	negligible	unknown
Findings	0	0	1	0	0	3
With a fix	0	0	1	0	0	3

4 findings

ID	Package	Version	Severity	Fixed in	Platforms
GHSA-mqqf-5wvp-8fh8	github.com/go-chi/chi/v5	v5.2.3	medium	5.2.4	linux/amd64, linux/arm64
GO-2026-5774	github.com/go-chi/chi/v5	v5.2.3	unknown	5.3.0	linux/amd64, linux/arm64
GO-2026-5775	github.com/go-chi/chi/v5	v5.2.3	unknown	5.3.0	linux/amd64, linux/arm64
GO-2026-5777	github.com/go-chi/chi/v5	v5.2.3	unknown	5.3.0	linux/amd64, linux/arm64

Tests and rebuilds

Tests

The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (GET :8080/healthz) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Rebuild

Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-18 14:28 UTC

Rebuild gave sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313, the same digest as the image.

Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-checkout/actions/runs/39135799332/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.

Checked by a clearcutt-factory reproduction attestation, verified against a trusted signer; this run didn't rebuild it.

Attestation signed by https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0 (issuer https://token.actions.githubusercontent.com)

ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:9595974021b29623ee696febb2bb1da1217b6fd7890855e3990fb787a65104b9

Where it was reproduced, as the attestation says:

Run: https://github.com/northcutted/clearcutt-showcase-checkout/actions/runs/39135799332/attempts/1
Workflow northcutted/clearcutt-showcase-checkout/.github/workflows/factory.yml@refs/heads/main, job reproduce
Machine: github-hosted, linux/amd64
clearcutt-factory v0.3.0
BuildKit moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

Rebases recorded in the history, newest first
First recorded	Rebased from	Gave	Rebase record
2026-10-17 12:20 UTC	ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143	`sha256:2bde717bdacf`	Verified
2026-10-17 03:58 UTC	ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:f35fff619097e0cdcea224ed597f641d8353cbbe268e6c595c1cb2e67c2f1872	`sha256:e67531bdf7d6`	Verified

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base	Critical	High
2026-10-19 07:41 UTC	`sha256:b2f56e8e716f`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-19 01:05 UTC	`sha256:b2f56e8e716f`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-19 01:02 UTC	`sha256:b2f56e8e716f`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-19 00:27 UTC	`sha256:b2f56e8e716f`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-19 00:20 UTC	`sha256:b2f56e8e716f`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-18 14:29 UTC	`sha256:b2f56e8e716f` rebuilt, same base	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-18 14:11 UTC	`sha256:2bde717bdacf`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-18 14:10 UTC	`sha256:2bde717bdacf`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-18 07:25 UTC	`sha256:2bde717bdacf`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-17 14:43 UTC	`sha256:2bde717bdacf`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-17 14:38 UTC	`sha256:2bde717bdacf`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-17 14:06 UTC	`sha256:2bde717bdacf`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-17 14:03 UTC	`sha256:2bde717bdacf`	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-17 12:20 UTC	`sha256:2bde717bdacf` rebased	Verified	Proven, current `sha256:f6a0ee0f0f63`	0	0
2026-10-17 07:25 UTC	`sha256:e67531bdf7d6`	Verified	Proven, current `sha256:48499cde6a17`	4	22
2026-10-17 03:58 UTC	`sha256:e67531bdf7d6` rebased	Verified	Proven, current `sha256:48499cde6a17`	4	22
2026-10-17 01:19 UTC	`sha256:f35fff619097`	Verified	Proven, current `sha256:3f495a2e2d26`	0	0

? means unknown: the run had no vulnerability data for this image.

Critical findings

High findings

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:6971d089b05e27045058e334f1ed5d1bc844039c510f01238633123b942f303f`	14	16 MB
linux/arm64	`sha256:4d56ddccde41ab6872c2051a2678ca221a5bd2f25ab64c7868a2b8ffcf39312b`	14	15 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

26 package versions

Package	Version	Type
apk-tools	2.14.10-r17	apk
busybox	1.38.0-r3	apk
ca-certificates-bundle	20260909-r2	apk
github.com/go-chi/chi/v5	v5.2.3	golang
github.com/google/uuid	v1.6.0	golang
github.com/northcutted/clearcutt-showcase-checkout	UNKNOWN	golang
glibc-2.44	2.44-r8	apk
glibc-2.44-locale-posix	2.44-r8	apk
ld-linux-2.44	2.44-r8	apk
libbrotlicommon1	1.2.0-r6	apk
libbrotlidec1	1.2.0-r6	apk
libbrotlienc1	1.2.0-r6	apk
libcrypt1-2.44	2.44-r8	apk
libcrypto3	3.6.5-r2	apk
libgcc	16.2.0-r1	apk
libssl3	3.6.5-r2	apk
libxcrypt	4.5.2-r6	apk
openssl-4.0-libcrypto	4.0.3-r7	apk
openssl-4.0-libssl	4.0.3-r7	apk
openssl-provider-legacy-allowed	4.0.3-r1	apk
stdlib	go1.27.2	golang
tzdata	2026e-r0	apk
wolfi-base	1-r7	apk
wolfi-baselayout	20230201-r30	apk
wolfi-keys	1-r13	apk
zlib	1.3.2.1_rc20260921-r0	apk